Service Agents and the Search for Transitive Access in GCP ~ Kat Traxler
Presenters detail vulnerability discovery and exploitation in Service Agents and the Search for Transitive Access in GCP ~ Kat Traxler.
Summary
What GCP service agents are
Kat Traxler explains that Google manages thousands of internal service accounts, but only 87 "service agents" can appear per consumer project. Unlike AWS, GCP requires explicitly enabling services; a user with serviceusage.services.enable triggers creation of a Google-owned project service account.
Transitive access paths
Service agents matter because some APIs act on resources using the agent's identity rather than the caller's—especially in batch mode for services like Storage Transfer Service. An attacker with permission to invoke batch operations may move objects between buckets using the agent's privileges, not their own.
Demo and implications
Traxler demos exfiltrating storage objects across buckets within a project, noting the same mechanism could cross project boundaries where IAM allows. The talk urges defenders to map enabled services, agent identities, and batch-mode behaviors when hunting privilege escalation and data theft in GCP.
Related talks
Videos·36 min
Engineers explore architecture and security mechanisms for Optimising Business Value With Secure Access Service Edge by Neil Thacker.
TROOPERS IT Security Conference·45 min
Dominick Baier
Dominick Baier analyzes TROOPERS09 - .NET Access Control Service.
fwd:cloudsec Europe·25 min
Marcus Hallberg · Atilla Dulovics
Presenters detail vulnerability discovery and exploitation in GCP and AWS identity federation - lessons learned from the […] ~ Marcus Hallberg, Atilla Dulovics.